Tom's Hardware > Forum > Homebuilt Systems > General Homebuilt > How do i remove this virus... help please

How do i remove this virus... help please

Forum Homebuilt Systems : General Homebuilt - How do i remove this virus... help please

Tom's Hardware: Over 1.4 million members in 6 different countries available to answer all your high-tech questions. Sign up now! Its free!
Word :    Username :           
 

ok i have got another bloody trojan horse. i have no idea how i got it.. i scanned before i went to sleep then i scanned again in the morning and boom a virus..

i scanned it with AVG, and here is the info:

Virus Name: Trojan horse delf.crf
path: C:\System Volume information\_restore{F177DDB6-51A9-4158-A0F6-4939C2A4F6DE}\RP40\A0026048.exe
Filename: A0026048.exe
File Size 616 KB

How do i remove it, i cant even get into that directory to delete it..?


Message edited by Maverick7 on 01-24-2008 at 02:25:28 AM
Sponsored Links
Register or log in to remove.

To Remove Trojans, two things can be very helpful.

#1 - Create a Local Account that is only a "User" and not an admin.

(Net User Create Bob /add)..........from the command prompt.

#2 - Boot in Safe Mode as "Bob" and try to run your Virust cleaning software.

The "User" account with its limited rights will help prevent the virus from moving/stealthing about in most cases.

Safe Mode can also limit some of that.

If your AV software does not operate in safe mode, try just as "Bob".

------------------------------ If its good in theory but not in practice,
its not good theory.
Reply to zenmaster

i'm not an expert on viruses, but in do know that those numbers with dashes are significant. might be worth your while to edit your post with those numbers. good luck with that virus. i always end up doing a format/reinstall.

Reply to BigJ3384

alright i shall add them.

Is there anyway to delete the virus if avg has it in its 'virus vault'??

Reply to Maverick7

^yes

Weren't you the guy who had had a similer problem before?

------------------------------ http://farm3.static.flickr.com/2617/3815217176_0a5be7955d_o.gif
http://farm4.static.flickr.com/3553/3818083596_1a772f7162_o.gif
Reply to Shadow703793

sadly yes.. :( 8 viruses from a spyware doctor torrent.. = me having to wipe hard drive... 'cries' ..... iv had to do it 3 times in total now.. omfg not a fourth please...

so please how do i get this ass hole of my computer


Message edited by Maverick7 on 01-24-2008 at 02:51:53 AM
Reply to Maverick7

That file is located in system restore. Just disable system restore, run your virus scan and if it's gone, turn system restore back on.

Reply to lp231

I use avast.... and never had a virus actually infect my pc.

Your going to need some good virus removal software, some patience, and might end up having to install windows again.. sorry.

Reply to yay

also, on the slim chance that this virus relies on or affects either the boot sector or the master boot record, you can rewrite both by rebooting with your xp install cd in and starting a reinstall. shortly into the install process you will be asked if you want to launch the recovery console. this is NOT the same as pressing F2 and starting the Automated Recovery Console, this is a little later in the install, but not too far in. you will get a screen and unlimited time to choose the option, so no worries. just type "help" when the command prompt comes up and you'll see options to rewrite the MBR and/or boot sector. slim chance this will work, but it's worth a try before you do a full wipe. also note that this will disable your ability to boot into an alternate OS if you're on a dual boot system. you can reinstall the boot loader or reconfigure the windows boot parameters later though, so not all would be lost. good luck and keep us posted.

Reply to BigJ3384
Tom's Hardware > Forum > Homebuilt Systems > General Homebuilt > How do i remove this virus... help please
Go to:

There are 926 identified and unidentified users. To see the list of identified users, Click here.

Please mind

You are about to answer a thread that has been inactive for more than 6 months.
If you still wish to proceed, please ensure that your posting is original and does not duplicate or overlap any prior responses to this thread.

Add a reply Cancel
Sponsored links
  • Ask the community now
  • Publish
Ad
They won a badge
Join us in greeting them